Amendments In the Claims 

Please add Claims 31-34. Please amend Claims 1,9, 16 and 23-30 as follows: 



PATENT 



1. (Currently Amended) A method of collecting network traffic data 

comprising: 

collecting network traffic data wherein said collecting comprises 

receiving a group of information! [;]] a 

determining whether to process the group of information for network traffic data 
collection, wherein 

said determining is performed according to a sampling algorithm a that is 
selected from on e of 
a linear s ampling algorithm, 
an expon e ntial sampling algorithm, 
a natural log s ampling algorithm, 
a bur s t sampling algorithm, and 

s e l e cting th e group of information ba s ed on an e xamination of 
traffic attribute data in the group of information; 

processing the group of information for network traffic data collection if the 

determination is to process the group of information! [;]] a and 
forwarding the group of information to a destination. 

2. (Original) The method of Claim 1 wherein the group of information is an IP 

packet. 

3. (Canceled) 

4. (Original) The method of Claim 1 wherein forwarding the group of information 
to the destination comprises: 

identifying the destination using a forwarding table; 

if the destination is in the forwarding table, automatically forwarding the group of 
information to the destination; and 
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otherwise sending the group of information to one or more processing engines to 

determine routing to the destination and forwarding the group of information 
according to the determined routing. 

5. (Original) The method of Claim 1 wherein forwarding the group of information 
to the destination is performed after processing the group of information. 

6. (Previously Presented) The method of Claim 1 wherein the processing of the 
group of information for network traffic data collection comprises: 

determining if the group of information is part of one or more recorded traffic flows; 
creating a new entry in a table if the group of information is not part of the one or more 

recorded traffic flows; 
incrementing a field in an existing entry in the table if the group of information is part of 

the one or more recorded traffic flows; and 
time stamping the group of information. 

7. (Previously Presented) The method of Claim 6 wherein the processing of the 
group of information for network traffic data collection further comprises: 

creating a traffic information packet; and 

transmitting the traffic information packet to a network traffic data collection application. 

8. (Original) The method of Claim 7 wherein the traffic information packet 
comprises a header and one or more flow records. 

9. (Currently Amended) An apparatus for collecting network traffic data 

comprising: 

means for receiving a group of information; and 

means for collecting network traffic data said means for collecting comprising 

means for determining whether to process the group of information for network 
traffic data collection, wherein 

the means for determining comprises a means for sampling 2 se lected from 
one of 
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a m e an s for linear s ampling, 
a mean s for e xpon e ntial s ampling, 
a m e ans for natural log sampling, 
a mean s for burst s ampling, and 

a mean s for s electing th e group of information ba s ed on an 
e xamination of traffic attribute data in the group of 
information; 

means for processing the group of information for network traffic data collection 

if the determination is to process the group of information! [;]] a and 
means for forwarding the group of information to a destination. 

10. (Original) The apparatus of Claim 9 wherein the group of information is an IP 

packet. 

11. (Canceled) 

12. (Original) The apparatus of Claim 9 wherein the means for forwarding the group 
of information to the destination comprises: 

means for identifying the destination using a forwarding table; 

means for automatically forwarding the group of information to the destination if the 

destination is in the forwarding table; and 
means for sending the group of information to one or more processing engines to 

determine routing to the destination and then forward the group of information 

according to the determined routing otherwise. 

13. (Previously Presented) The apparatus of Claim 9 wherein the means for 
processing of the group of information for network traffic data collection comprises: 

means for determining if the group of information is part of one or more recorded traffic 
flows; 

means for creating a new entry in a table if the group of information is not part of the one 

or more recorded traffic flows; 
means for incrementing a field in an existing entry in the table if the group of information 

is part of the one or more recorded traffic flows; and 
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means for time stamping the group of information. 

14. (Previously Presented) The apparatus of Claim 13 herein the means for 
processing of the group of information for network traffic data collection further comprises: 

means for creating a traffic information packet; and 

means for transmitting the traffic information packet to a network traffic data collection 
application. 

15. (Original) The apparatus of Claim 14 wherein the traffic information packet 
comprises a header and one or more flow records. 

1 6. (Currently Amended) A network node comprising: for collecting network 
traffic data having one or mor e proce ss ing engine s and a m e mory compri s ing a set of 
instruction s to: 

a processing engine, wherein 

the processing engine is configured to collect network traffic data; and 
a memory coupled to the processing engine and the memory is configured to store 

instructions configured to cause the processing engine to 

receive a group of information; 

determine whether to process the group of information for network traffic data 
collection according to a sample algorithm; , wh e rein 
the s et of in s tructions to determine comprises a s ampling algorithm 

that i s s e lect e d from one of 

a lin e ar sampling algorithm, 

an expon e ntial sampling algorithm, 

a natural log s ampling algorithm, 

a burst s ampling algorithm, and 

s electing th e group of information ba s ed on an examination of 
traffic attribute data in the group of information; 

process the group of information for network traffic data collection if the 

determination is to process the group of information; and 
forward the group of information to the destination. 
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17. (Original) The network node of Claim 16 wherein the group of information is an 
EP packet. 

18. (Canceled) 

19. (Original) The network node of Claim 16 wherein the set of instructions to 
forward the group of information to the destination comprises a set of instructions to: 

identify the destination using a forwarding table; 

if the destination is in the forwarding table, automatically forward the group of 

information to the destination; and 
otherwise send the group of information to one or more processing engines to determine 

routing to the destination and forward the group of information according to the 

determined routing. 

20. (Previously Presented) The network node of Claim 16 wherein the set of 
instructions to process the group of information for network traffic data collection comprises a 
set of instructions to : 

determine if the group of information is part of one or more recorded traffic flows; 
create a new entry in a table if the group of information is not part of the one or more 
recorded traffic flows; 

increment a field in an existing entry in the table if the group of information is part of the 

one or more recorded traffic flows; and 
time stamp the group of information. 

2 1 . (Previously Presented) The network node of Claim 20 wherein the set of 
instructions to process the group of information for network data collection further comprises a 
set of instructions to: 

create a traffic information packet; and 

transmit the traffic information packet to a network traffic data collection application. 

22. (Original) The network node of Claim 21 wherein the traffic information packet 
comprises a header and one or more flow records. 
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23. (Currently Amended) A router comprising: 
one or more switch fabrics; 

one or more destination line cards coupled to the one or more switch fabrics; 
a source line card coupled to one of the one or more switch fabrics, wherein 

the source line card receives a data packet; 
a router processor, coupled to the switch fabric, and configured to 

determine whether to process the data packet for network traffic data collection 

according to a sample algorithm; 
process the data packet for network traffic data collection if the determination is 

to process the data packet; and 
forward forwards the data packet to one of the one or more destination line 
cards. 

24. (Currently Amended) The router apparatus of Claim 23 wherein the data 
packet is an IP packet. 

25. (Currently Amended) The router apparatu s of Claim 23 wherein the router 
processor is further configured to select the sample algorithm is selected from one of [[a]) 
linear sampling algorithm , a» exponential sampling algorithm , [[a]] natural log sampling 
algorithm , [[a]] burst sampling algorithm , and selecting the data packet based on an 
examination of traffic attribute data in the data packet. 

26. (Currently Amended) The router apparatus of Claim 23 wherein to forward 
the data packet to one of the one or more destination line cards, the source line card is 
configured to : 

identify id e ntifi e s the one of the one or more destination line cards using a forwarding 
table; 

if the one of the one or more destination line cards is in the forwarding table, 

automatically forward forward s the data packet to the one of the one or more 
destination line cards; and 

otherwise send sends the data packet to the router processor[[s]] wherein the router 
processor is configured to 
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determine routing to one of the one or more destination line cardsj and 
then forward! [s]] the data packet according to the determined routing. 

27. (Currently Amended) The router apparatu s of Claim 26 wherein the router 
processor is located on the source line card. 

28. (Currently Amended) The router apparatu s of Claim 23 wherein to process 
the data packet for network traffic data collection, the source line card is configured to : 

determine [[s]] if the data packet is part of one or more recorded traffic flows; 
create[[s]] a new entry in a table if the data packet is not part of the one or more recorded 
traffic flows; 

increment [[s]] a field in an existing entry in the table if the data packet is part of the one 

or more recorded traffic flows; and 
time stamp [[s]] the data packet. 

29. (Currently Amended) The router apparatu s of Claim 28 wherein to process 
the data packet for network traffic data collection, the source line card is further configured to : 

create [[s]] a traffic information packet; and 

transmit[[s]] the traffic information packet to a network traffic data collection application. 

30. (Currently Amended) The router apparatus of Claim 29 wherein the traffic 
information packet comprises a header and one or more flow records. 



31. (New) The method of Claim 1 wherein said collecting further comprises: 
selecting the sample algorithm, wherein the sample algorithm is one of a linear, an 

exponential, a natural log, and a burst sample algorithm, and examination of 
traffic attribute data in the group of information. 

32. (New) The apparatus of Claim 9 wherein the means for determining further 
comprises: 

means for selecting the means for sampling from one of 
a means for linear sampling, 
a means for exponential sampling, 
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a means for natural log sampling, 
a means for burst sampling, and 

a means for examining traffic attribute data in the group of information. 

33 . (New) The network node of Claim 16 having the memory further configured to 
store instructions to select the sample algorithm from one of 
a linear sampling algorithm, 
an exponential sampling algorithm, 
a natural log sampling algorithm, 
a burst sampling algorithm, and 

selecting the group of information based on.an examination of traffic attribute data in the 
group of information. 

34. (New) The network node of Claim 16 wherein the network node further 
comprises: 

a plurality of processing engines, wherein 

the plurality of processing engines comprise the processing engine. 
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